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1 Introduction 


This is a specification of the Shell Link Binary File Format. In this format a structure is called a shell 
link, or shortcut, and is a data object that contains information that can be used to access 
another data object. The Shell Link Binary File Format is the format of Windows files with the 
extension "LNK". 

Shell links are commonly used to support application launching and linking scenarios, such as 
Object Linking and Embedding (OLE), but they also can be used by applications that need the 
ability to store a reference to a target file. 

Sections 1.7 and 2 of this specification are normative and can contain the terms MAY, SFIOULD, 
MUST, MUST NOT, and SFIOULD NOT as defined in RFC 2119. All other sections and examples in this 
specification are informative. 


1.1 Glossary 

The following terms are defined in rMS-GLOSl : 

American National Standards Institute (ANSI) character set 
Augmented Backus-Naur Form (ABNF) 
class identifier (CLSID) 
code page 

Component Object Model (COM) 

Coordinated Universal Time (UTC) 

GUID 

little-endian 
NetBIOS name 
object (3) 
reparse point 
sparse file 
Unicode 

Universal Naming Convention (UNC) 

The following terms are specific to this document: 

extra data section: A data structure appended to the basic Shell Link Binary File Format data 
that contains additional information about the link target. 

folder integer ID: An integer value that identifies a known folder. 

folder GUID ID: A GUID value that identifies a known folder. Some folder GUID ID values 
correspond to folder integer ID values. 

item ID (ItemID): A structure that represents an item in the context of a shell data source. 

item ID list (IDList): A data structure that refers to a location. An item ID list is a multi- 
segment data structure where each segment's content is defined by a data source that is 
responsible for the location in the namespace referred to by the preceding segments. 

link: An object that refers to another item. 

link target: The item that a link references. In the case of a shell link, the referenced item is 
identified by its location in the link target namespace using an item ID list (IDList). 
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link target namespace: A hierarchical namespace. In Windows, the link target namespace is 
the Windows Explorer namespace, as described in rMSDN-ShellNamespacel . 

namespace: An abstract container used to hold a set of unique identifiers. 

Object Linking and Embedding (OLE): A technology for transferring and sharing information 
between applications by inserting a file or part of a file into a compound document. The 
inserted file can be either linked or embedded. An embedded item is stored as part of the 
compound document that contains it; a linked item stores its data in a separate file. 

relative path: A path that is implied by the current working directory or is calculated based on a 
specified directory. When a user enters a command that refers to a file, and the full path is 
not entered, the current working directory becomes the relative path of the referenced file. 

resolve a link: The act of finding a specific link target, confirming that it exists, and finding 
whether it has moved. 

Red-Green-Blue (RGB): A mapping of color components in which red, green, and blue and an 
intensity value are combined in various ways to reproduce a range of colors. 

shell data source: An object that is responsible for a specific location in the namespace and 
for enumerating and binding IDLists to handlers. 

shell link: A structure in Shell Link Binary File Format. 

shim: A mechanism used to provide custom behavior to applications that do not work on newer 
versions of the operating system. 

shortcut: A term that is used synonymously with shell link. 

MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as 
described in rRFC21191 . All statements of optional behavior use either MAY, SHOULD, or 
SHOULD NOT. 

1.2 References 

References to Microsoft Open Specifications documentation do not include a publishing year because 
links are to the latest version of the documents, which are updated frequently. References to other 
documents include a publishing year when one is available. 

A reference marked "(Archived)" means that the reference document was either retired and is no 
longer being maintained or was replaced with a new document that provides current implementation 
details. We archive our documents online fWindows Protocoil . 

1.2.1 Normative References 

We conduct frequent surveys of the normative references to assure their continued availability. If 
you have any issue with finding a normative reference, please contact dochelp@microsoft.com . We 
will assist you in finding the relevant information. Please check the archive site, 
http://msdn2.microsoft.com/en-us/librarv/E4BD6494-06AD-4aed-9823-445E921C9624, as an 

additional source. 

[MS-DFSNM] Microsoft Corporation, " Distributed File System (DFS): Namespace Management 
Protocol ". 

[MS-DTYP] Microsoft Corporation, " Windows Data Types ". 
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[MS-LCID] Microsoft Corporation, " Windows Language Code Identifier (LCID! Reference ". 
[MS-PROPSTORE] Microsoft Corporation, " Property Store Binary File Format ". 


[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 
2119, March 1997, http://www.rfc-editor.org/rfc/rfc2119.txt 

[RFC5234] Crocker, D., Ed., and Overell, P., "Augmented BNF for Syntax Specifications: ABNF", STD 
68, RFC 5234, January 2008, http://www.rfc-editor.org/rfc/rfc5234.txt 

1.2.2 Informative References 

[C706] The Open Group, "DCE 1.1: Remote Procedure Call", C706, August 1997, 
https://www2.opengroup.org/ogsvs/catalog/c706 

[MS-CFB] Microsoft Corporation, " Compound File Binary File Format ". 

[MS-DLTW] Microsoft Corporation, " Distributed Link Tracking: Workstation Protocol ". 

[MS-GLOS] Microsoft Corporation, " Windows Protocols Master Glossary ". 

[MSCHARSET] Microsoft Corporation, "INFO: Windows, Code Pages, and Character Sets", February 
2005, http://support.microsoft.com/kb/75435 

[MSDN-CODEPAGE] Microsoft Corporation, "Common Pages", http://msdn.microsoft.com/en- 
us/goglobal/bb964653.aspx 

[MSDN-ISHELLLINK] Microsoft Corporation, "IShellLink Interface", http://msdn.microsoft.com/en- 
us/librarv/bb774950.aspx 

[MSDN-MSISHORTCUTS] Microsoft Corporation, "How Windows Installer Shortcuts Work", 
http://support.microsoft.com/kb/243630 

1.3 Overview 

The Shell Link Binary File Format specifies a structure called a shell link. That structure is used to 
store a reference to a location in a link target namespace, which is referred to as a link target. 
The most important component of a link target namespace is a link target in the form of an item ID 
list (IDList). 

The shell link structure stores various information that is useful to end users, including: 

■ A keyboard shortcut that can be used to launch an application. 

■ A descriptive comment. 

■ Settings that control application behavior. 

■ Optional data stored in extra data sections. 

Optional data can include a property store that contains an extensible set of properties in the format 
that is described in rMS-PROPSTOREl . 

The Shell Link Binary File Format can be managed using a COM object, programmed using the 
IShellLink interface, and saved into its persistence format using the IPersistStream or 
IPersistFile interface. It is most common for shell links to be stored in a file with the .LNK file 
extension. By using the IPersistStream interface, a shell link can be saved into another storage 
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system, for example a database or the registry, or embedded in another file format. For more 
information, see rMSDN-ISHELLLINKl . 

Multi-byte data values in the Shell Link Binary File Format are stored in little-endian format. 

1.4 Relationship to Protocols and Other Structures 

The Shell Link Binary File Format is used by the Compound File Binary File Format rMS-CFBI . 

The Shell Link Binary File Format uses the Property Store Binary File Format rMS-PROPSTOREl . 

1.5 Applicability Statement 

This document specifies a persistence format for links to files in a file system or to applications that 
are available for installation. This persistence format is applicable for use as a stand-alone file and 
for containment within other structures. 

1.6 Versioning and Localization 

This specification covers versioning issues in the following areas: 

Localization: The Shell Link Binary File Format defines the ConsoleFEDataBlock structure (section 
2 . 5 . 2 ). which specifies a code page for displaying text. That value can be used to specify a set of 
characters for a particular language or locale. 

1.7 Vendor-Extensible Fields 

A shell data source can extend the persistence format by storing custom data inside ItemID 
structure. 

The ItemIDs embedded in an IDList are in a format specified by the shell data sources that manage 
the ItemIDs. The ItemIDs are free to store whatever data is needed in this structure to uniquely 
identify the items in their namespace. 

The property store embedded in a link can be used to store property values in the shell link. 
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2 Structures 


The Shell Link Binary File Format consists of a sequence of structures that conform to the following 
ABNF rules fRFC52341 . 


SHELL_LINK = SHELL_LINK_HEADER [ LINKTARGET_IDLI ST ] [LINKINFO] 
[STRINGJ3ATA] *EXTRA_DATA 


SH ELL_LI N K_FI E AD E R : A ShellLinkHeader structure (section 2. IT which contains identification 
information, timestamps, and flags that specify the presence of optional structures. 

LINKTARGET_IDLIST : An optional LinkTarqetIDList structure (section 2 . 2 ), which specifies the 
target of the link. The presence of this structure is specified by the HasLinkTargetIDList bit 
(LinkFlaqs section 2.1.1) in the ShellLinkFleader. 

LINKINFO: An optional Linklnfo structure (section 2.3) . which specifies information necessary to 
resolve the link target. The presence of this structure is specified by the HasLinklnfo bit (LinkFlags 
section 2.1.1) in the ShellLinkFleader. 

STRING_DATA: Zero or more optional StrinqData structures (section 2.4 ). which are used to 
convey user interface and path identification information. The presence of these structures is 
specified by bits (LinkFlags section 2.1.1) in the ShellLinkFleader. 

EXTRA_DATA: Zero or more Extra Data structures (section 2.5) . 

Note Structures of the Shell Link Binary File Format can define strings in fixed-length fields. In 
fixed-length fields, strings MUST be null-terminated. If a string is smaller than the size of the field 
that contains it, the bytes in the field following the terminating null character are undefined and can 
have any value. The undefined bytes MUST NOT be used. 

2.1 ShellLinkHeader 

The ShellLinkFleader structure contains identification information, timestamps, and flags that specify 
the presence of optional structures, including LinkTarqetIDList (section 2.2) . Linklnfo (section 2.3) . 
and StrinqData (section 2.4) . 


1 2 3 

01234567890123456789012345678901 


HeaderSize 


LinkCLSID 


LinkFlags 
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FileAttributes 

CreationTime 


AccessTime 


WriteTime 


FileSize 

Iconlndex 

ShowCommand 

Hotkey Reserved 1 

Reserved2 

Reserved3 


HeaderSize (4 bytes): The size, in bytes, of this structure. This value MUST be 0x0000004C. 

LinkCLSID (16 bytes): A class identifier (CLSID). This value MUST be 00021401-0000- 
0000-C000-000000000046. 

LinkFlags (4 bytes): A LinkFlaqs structure (section 2.1.1 ) that specifies information about the 
shell link and the presence of optional portions of the structure. 

FileAttributes (4 bytes): A FileAttributesFlaas structure (section 2.1.2) that specifies 
information about the link target. 

CreationTime (8 bytes): A FILETIME structure ( rMS-DTYPl section 2.3.3) that specifies the 
creation time of the link target in UTC (Coordinated Universal Time). If the value is zero, 
there is no creation time set on the link target. 

AccessTime (8 bytes): A FILETIME structure ( rMS-DTYPl section 2.3.3) that specifies the 
access time of the link target in UTC (Coordinated Universal Time). If the value is zero, 
there is no access time set on the link target. 

WriteTime (8 bytes): A FILETIME structure ( rMS-DTYPl section 2.3.3) that specifies the write 
time of the link target in UTC (Coordinated Universal Time). If the value is zero, there is 
no write time set on the link target. 
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FileSize (4 bytes): A 32-bit unsigned integer that specifies the size, in bytes, of the link target. 
If the link target file is larger than OxFFFFFFFF, this value specifies the least significant 32 bits 
of the link target file size. 

Iconlndex (4 bytes): A 32-bit signed integer that specifies the index of an icon within a given 
icon location. 

ShowCommand (4 bytes): A 32-bit unsigned integer that specifies the expected window state 
of an application launched by the link. This value SFIOULD be one of the following. 


Value 

Meaning 

SW_SHOWNORMAL 

0x00000001 

The application is open and its window is open in a normal fashion. 

SW SHOWMAXIMIZED 
0x00000003 

The application is open, and keyboard focus is given to the application, 
but its window is not shown. 

SW SHOWMINNOACTIVE 
0x00000007 

The application is open, but its window is not shown. It is not given the 
keyboard focus. 


All other values MUST be treated as SW_SHOWNORMAL. 

HotKey (2 bytes): A FlotKevFlaqs structure (section 2.1.3) that specifies the keystrokes used 
to launch the application referenced by the shortcut key. This value is assigned to the 
application after it is launched, so that pressing the key activates that application. 

Reservedl (2 bytes): A value that MUST be zero. 

Reserved2 (4 bytes): A value that MUST be zero. 

Reserved3 (4 bytes): A value that MUST be zero. 


2.1.1 LinkFlags 

The LinkFlags structure defines bits that specify which shell link structures are present in the file 
format after the ShellLinkHeader structure (section 2.1 ). 


0 1 2 3 4 5 6 7 


ABCDEFGH 


Where the bits are defined as: 


Value 

Description 

A 

HasLinkTargetIDList 

The shell link is saved with an item ID list (IDList). If this bit is set, 
a LinkTaraetIDList structure (section 2.2) MUST follow the 
ShellLinkHeader. If this bit is not set, this structure MUST NOT be 
present. 
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Value 

Description 

B 

HasLinklnfo 

The shell link is saved with link information. If this bit is set, a 
Linklnfo structure (section 2.3) MUST be present. If this bit is not 
set, this structure MUST NOT be present. 

C 

HasName 

The shell link is saved with a name string. If this bit is set, a 

NAME STRING StrinaData structure fsection 2.4) MUST be 
present. If this bit is not set, this structure MUST NOT be present. 

D 

HasRelativePath 

The shell link is saved with a relative path string. If this bit is set, 
a RELATIVE_PATH StringData structure (section 2A) MUST be 
present. If this bit is not set, this structure MUST NOT be present. 

E 

HasWorkingDir 

The shell link is saved with a working directory string. If this bit is 
set, a WORKING_DIR StringData structure (section 2A) MUST 
be present. If this bit is not set, this structure MUST NOT be 
present. 

F 

HasArguments 

The shell link is saved with command line arguments. If this bit is 
set, a COMMAND_LINE_ARGUMENTS StringData structure 
(section 2.41 MUST be present. If this bit is not set, this structure 
MUST NOT be present. 

G 

HasIconLocation 

The shell link is saved with an icon location string. If this bit is set, 
an ICON_LOCATION StringData structure (section 2A) MUST be 
present. If this bit is not set, this structure MUST NOT be present. 

H 

IsUnicode 

The shell link contains Unicode encoded strings. This bit SHOULD 
be set. If this bit is set, the StringData section should contain 
Unicode-encoded strings; otherwise, it should contain strings that 
are encoded using the system default code page. 

I 

ForceNoLinklnfo 

The Linklnfo structure (section 2.31 is ignored. 

J 

HasExpString 

The shell link is saved with an EnvironmentVariableDataBlock 
fsection 2.5.4V 

K 

RunlnSeparateProcess 

The target is run in a separate virtual machine when launching a 
link target that is a 16-bit application. 

L 

Unusedl 

A bit that is undefined and MUST be ignored. 

M 

HasDarwinID 

The shell link is saved with a DarwinDataBlock fsection 2.5.3V 

N 

RunAsUser 

The application is run as a different user when the target of the 
shell link is activated. 

0 

HasExpIcon 

The shell link is saved with an IconEnvironmentDataBlock (section 
2,5.5V 

P 

NoPidlAlias 

The file system location is represented in the shell namespace 
when the path to an item is parsed into an IDList. 
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Value 

Description 

Q 

Unused2 

A bit that is undefined and MUST be ignored. 

R 

RunWithShimLayer 

The shell link is saved with a ShimDataBlock fsection 2.5.81. 

S 

ForceNoLinkTrack 

The TrackerDataBlock fsection 2.5.101 is iqnored. 

T 

EnableTargetMetadata 

The shell link attempts to collect target properties and store them 
in the ProoertvStoreDataBlock fsection 2.5.71 when the link taraet 
is set. 

U 

DisableLinkPathTracking 

The EnvironmentVariableDataBlock is ignored. 

V 

DisableKnownFolderT racking 

The SpecialFolderDataBlock (section 2.5.91 and the 
KnownFolderDataBlock (section 2.5.61 are iqnored when loadinq 
the shell link. If this bit is set, these extra data blocks SHOULD 

NOT be saved when saving the shell link. 

W 

DisableKnownFolderAlias 

If the link has a KnownFolderDataBlock (section 2.5.6), the 
unaliased form of the known folder IDList SHOULD be used when 
translating the target IDList at the time that the link is loaded. 

X 

AllowLinkToLink 

Creating a link that references another link is enabled. Otherwise, 
specifying a link as the target IDList SHOULD NOT be allowed. 

Y 

UnaliasOnSave 

When saving a link for which the target IDList is under a known 
folder, either the unaliased form of that known folder or the target 
IDList SHOULD be used. 

Z 

PreferEnvironmentPath 

The target IDList SHOULD NOT be stored; instead, the path 
specified in the EnvironmentVariableDataBlock (section 2.5.4) 
SHOULD be used to refer to the target. 

AA 

KeepLocallDListForUNCTarget 

When the target is a UNC name that refers to a location on a local 
machine, the local path IDList in the PropertyStoreDataBlock 
(section 2.5.7) SHOULD be stored, so it can be used when the link 
is loaded on the local machine. 


2.1.2 FileAttributesFlags 

The FileAttributesFlags structure defines bits that specify the file attributes of the link target, if the 
target is a file system item. File attributes can be used if the link target is not available, or if 
accessing the target would be inefficient. It is possible for the target items attributes to be out of 
sync with this value. 


l 2 3 

01234567890123456789012345678901 


ABCDEFGH I J KLMNOOOOOOOOOOOOOOOOOO 


12/51 

[MS-SHLLINK] - V20131025 
Shell Link (.LNK) Binary File Format 

Copyright © 2013 Microsoft Corporation. 

Release: Friday, October 25, 2013 



Where the bits are defined as: 


Value 

Description 

A 

FI LE_ATTRI BUTE_READON LY 

The file or directory is read-only. For a file, if this bit 
is set, applications can read the file but cannot write 
to it or delete it. For a directory, if this bit is set, 
applications cannot delete the directory. 

B 

FILE_ATTRIBUTE_HIDDEN 

The file or directory is hidden. If this bit is set, the 
file or folder is not included in an ordinary directory 
listing. 

C 

FI LE_ATTRIBUTE_SYSTE M 

The file or directory is part of the operating system 
or is used exclusively by the operating system. 

D 

Reserved 1 

A bit that MUST be zero. 

E 

FI LE_ATTRI BUTE_DI RECTO RY 

The link target is a directory instead of a file. 

F 

FILE_ATTRIBUTE_ARCHIVE 

The file or directory is an archive file. Applications 
use this flag to mark files for backup or removal. 

G 

Reserved2 

A bit that MUST be zero. 

H 

FILE_ATTRIBUTE_NORMAL 

The file or directory has no other flags set. If this bit 
is 1, all other bits in this structure MUST be clear. 

I 

FI LE_ATTRIBUTE_TEM PORARY 

The file is being used for temporary storage. 

J 

FI LE_ATTRIBUTE_SPARS E_FI LE 

The file is a sparse file. 

K 

FI LE_ATTRIBUTE_RE PARS E_POI NT 

The file or directory has an associated reparse 
point. 

L 

FI LE_ATTRI BUTE_COM PRESSED 

The file or directory is compressed. For a file, this 
means that all data in the file is compressed. For a 
directory, this means that compression is the default 
for newly created files and subdirectories. 

M 

FILE_ATTRIBUTE_OFFLINE 

The data of the file is not immediately available. 

N 

FI LE_ATTRIBUTE_NOT_CO NTE NT_I N D EX ED 

The contents of the file need to be indexed. 

0 

FILE_ATTRIBUTE_ENCRYPTED 

The file or directory is encrypted. For a file, this 
means that all data in the file is encrypted. For a 
directory, this means that encryption is the default 
for newly created files and subdirectories. 
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2.1.3 HotKeyFlags 

The HotKeyFlags structure specifies input generated by a combination of keyboard keys being 
pressed. 
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LowByte (1 byte): An 8-bit unsigned integer that specifies a virtual key code that corresponds 
to a key on the keyboard. This value MUST be one of the following: 


Value 

Meaning 

0x30 

"0" key 

0x31 

"1" k e y 

0x32 

"2" key 

0x33 

"3" key 

0x34 

"4" key 

0x35 

"5" key 

0x36 

"6" key 

0x37 

"7" key 

0x38 

"8" key 

0x39 

"9" key 

0x41 

"A" key 

0x42 

"B" key 

0x43 

"C" key 

0x44 

"D" key 

0x45 

"E" key 

0x46 

"F" key 

0x47 

"G" key 

0x48 

"H" key 

0x49 

"I" key 

0x4 A 

"J" key 

0x4B 

"K" key 
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Value 

Meaning 

Ox4C 

"L" key 

Ox4D 

"M" key 

Ox4E 

"N" key 

Ox4F 

"0" key 

0x50 

"P" key 

0x51 

"Q" key 

0x52 

"R" key 

0x53 

"S" key 

0x54 

"T" key 

0x55 

"U" key 

0x56 

"V" key 

0x57 

"W" key 

0x58 

"X" key 

0x59 

"Y" key 

0x5A 

"Z" key 

VK FI 

"FI" key 

0x70 


VK F2 

"F2" key 

0x71 


VK F3 

"F3" key 

0x72 


VK_F4 

"F4" key 

0x73 


VK_F5 

"F5" key 

0x74 


VK F6 

"F6" key 

0x75 


VK_F7 

"F7" key 

0x76 


VK F8 

"F8" key 

0x77 


VK F9 

"F9" key 

0x78 
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HighByte (1 byte): An 8-bit unsigned integer that specifies bits that correspond to modifier 
keys on the keyboard. This value MUST be one or a combination of the following: 
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Value 

Meaning 

HOTKEYF SHIFT 

0x01 

The "SHIFT" key on the keyboard. 

HOTKEYF CONTROL 

0x02 

The "CTRL" key on the keyboard. 

HOTKEYF_ALT 

0x04 

The "ALT" key on the keyboard. 


2.2 LinkTargetIDList 

The LinkTargetIDList structure specifies the target of the link. The presence of this optional structure 
is specified by the HasLinkTargetIDList bit ( LinkFlaos section 2.1.1) in the ShellLinkHeader 
(section 2. IT 
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IDList (variable) 



IDListSize (2 bytes): The size, in bytes, of the IDList field. 

IDList (variable): A stored IDList structure (section 2.2.1 1. which contains the item ID list. An 
IDList structure conforms to the following ABNF rRFC52341 : 


IDLIST = *ITEMID TERMINALID 


2.2.1 IDList 

The stored IDList structure specifies the format of a persisted item ID list. 
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ItemIDList (variable): An array of zero or more ItemID structures (section 2.2.2) . 

TerminallD (2 bytes): A 16-bit, unsigned integer that indicates the end of the item IDs. This 
value MUST be zero. 
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2.2.2 ItemID 


An ItemID is an element in an IDList structure (section 2.2.11 . The data stored in a given ItemID is 
defined by the source that corresponds to the location in the target namespace of the preceding 
ItemIDs. This data uniquely identifies the items in that part of the namespace. 
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ItemIDSize (2 bytes): A 16-bit, unsigned integer that specifies the size, in bytes, of the 
ItemID structure, including the ItemIDSize field. 

Data (variable): The shell data source-defined data that specifies an item. 

2.3 Linklnfo 

The Linklnfo structure specifies information necessary to resolve a link target if it is not found in 
its original location. This includes information about the volume that the target was stored on, the 
mapped drive letter, and a Universal Naming Convention (UNC) form of the path if one existed when 
the link was created. For more details about UNC paths, see rMS-DFSNMl section 2. 2. 1.4. 


1 2 3 

01234567890123456789012345678901 


LinklnfoSize 


LinklnfoHeaderSize 


LinklnfoFlags 


VolumelDOffset 


LocalBasePathOffset 


CommonNetworkRelativeLinkOffset 


CommonPathSuffixOffset 


LocalBasePathOffsetUnicode (optional) 


CommonPathSuffixOffsetUnicode (optional) 


VolumelD (variable) 
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LocalBasePath (variable) 


CommonNetworkRelativeLink (variable) 


CommonPathSuffix (variable) 


LocalBasePathUnicode (variable) 


CommonPathSuffixUnicode (variable) 


LinklnfoSize (4 bytes): A 32-bit, unsigned integer that specifies the size, in bytes, of the 
Linklnfo structure. All offsets specified in this structure MUST be less than this value, and all 
strings contained in this structure MUST fit within the extent defined by this size. 

LinklnfoHeaderSize (4 bytes): A 32-bit, unsigned integer that specifies the size, in bytes, of 
the Linklnfo header section, which is composed of the LinklnfoSize, LinklnfoHeaderSize, 
LinklnfoFlags, VolumelDOffset, Local BasePathOffset, 

CommonNetworkRelativeLinkOffset, CommonPathSuffixOffset fields, and, if included, 
the LocalBasePathOffsetUnicode and CommonPathSuffixOffsetUnicode fields. <l> 


Value 

Meaning 

OxOOOOOOlC 

Offsets to the optional fields are not specified. 

0x00000024 < value 

Offsets to the optional fields are specified. 


LinklnfoFlags (4 bytes): Flags that specify whether the VolumelD, LocalBasePath, 
LocalBasePathUnicode, and CommonNetworkRelativeLink fields are present in this 
structure. 


1 2 3 

01234567890123456789012345678901 


AB000000000000000000000000000000 


Where the bits are defined as: 
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Value 

Description 

A 

VolumelDAndLocalBasePath 

If set, the VolumelD and LocalBasePath fields are 
present, and their locations are specified by the 
values of the VolumelDOffset and 
LocalBasePathOffset fields, respectively. If the 
value of the LinklnfoHeaderSize field is greater 
than or equal to 0x00000024, the 
LocalBasePathUnicode field is present, and its 
location is specified by the value of the 
LocalBasePathOffsetUnicode field. 

If not set, the VolumelD, LocalBasePath, and 
LocalBasePathUnicode fields are not present, and 
the values of the VolumelDOffset and 
LocalBasePathOffset fields are zero. If the value of 
the LinklnfoHeaderSize field is greater than or 
equal to 0x00000024, the value of the 
LocalBasePathOffsetUnicode field is zero. 

B 

CommonNetworkRelativeLinkAndPathSuffix 

If set, the CommonNetworkRelativeLink field is 
present, and its location is specified by the value of 

the CommonNetworkRelativeLinkOffset field. 

If not set, the CommonNetworkRelativeLink field 
is not present, and the value of the 

CommonNetworkRelativeLinkOffset field is zero. 


VolumelDOffset (4 bytes): A 32-bit, unsigned integer that specifies the location of the 
VolumelD field. If the VolumelDAndLocalBasePath flag is set, this value is an offset, in 
bytes, from the start of the Linklnfo structure; otherwise, this value MUST be zero. 

LocalBasePathOffset (4 bytes): A 32-bit, unsigned integer that specifies the location of the 
LocalBasePath field. If the VolumelDAndLocalBasePath flag is set, this value is an offset, 
in bytes, from the start of the Linklnfo structure; otherwise, this value MUST be zero. 

CommonNetworkRelativeLinkOffset (4 bytes): A 32-bit, unsigned integer that specifies the 
location of the CommonNetworkRelativeLink field. If the 

CommonNetworkRelativeLinkAndPathSuffix flag is set, this value is an offset, in bytes, 
from the start of the Linklnfo structure; otherwise, this value MUST be zero. 

CommonPathSuffixOffset (4 bytes): A 32-bit, unsigned integer that specifies the location of 
the CommonPathSuffix field. This value is an offset, in bytes, from the start of the Linklnfo 
structure. 

LocalBasePathOffsetUnicode (4 bytes): An optional, 32-bit, unsigned integer that specifies 
the location of the LocalBasePathUnicode field. If the VolumelDAndLocalBasePath flag is 
set, this value is an offset, in bytes, from the start of the Linklnfo structure; otherwise, this 
value MUST be zero. This field can be present only if the value of the LinklnfoHeaderSize 
field is greater than or equal to 0x00000024. 

CommonPathSuffixOffsetUnicode (4 bytes): An optional, 32-bit, unsigned integer that 
specifies the location of the CommonPathSuffixUnicode field. This value is an offset, in 
bytes, from the start of the Linklnfo structure. This field can be present only if the value of the 
LinklnfoHeaderSize field is greater than or equal to 0x00000024. 
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VolumelD (variable): An optional VolumelD structure (section 2.3.1) that specifies 

information about the volume that the link target was on when the link was created. This field 
is present if the VolumelDAndLocalBasePath flag is set. 

LocalBasePath (variable): An optional, NULL-terminated string, defined by the system default 
code page, which is used to construct the full path to the link item or link target by appending 
the string in the CommonPathSuffix field. This field is present if the 

VolumelDAndLocalBasePath flag is set. 

CommonNetworkRelativeLink (variable): An optional CommonNetworkRelativeLink structure 
(section 2.3.2) that specifies information about the network location where the link target is 
stored. 

CommonPathSuffix (variable): A NULL-terminated string, defined by the system default code 
page, which is used to construct the full path to the link item or link target by being appended 
to the string in the LocalBasePath field. 

LocalBasePathUnicode (variable): An optional, NULL-terminated, Unicode string that is 
used to construct the full path to the link item or link target by appending the string in the 
CommonPathSuffixUnicode field. This field can be present only if the 
VolumelDAndLocalBasePath flag is set and the value of the LinklnfoHeaderSize field is 
greater than or equal to 0x00000024. 

CommonPathSuffixUnicode (variable): An optional, NULL-terminated, Unicode string that is 
used to construct the full path to the link item or link target by being appended to the string in 
the LocalBasePathUnicode field. This field can be present only if the value of the 
LinklnfoHeaderSize field is greater than or equal to 0x00000024. 

2.3.1 VolumelD 

The VolumelD structure specifies information about the volume that a link target was on when the 
link was created. This information is useful for resolving the link if the file is not found in its original 
location. 


l 2 3 

01234567890123456789012345678901 


VolumelDSize 


DriveType 


DriveSerialNumber 


VolumeLabelOffset 


VolumeLabelOffsetUnicode (optional) 


Data (variable) 
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VolumelDSize (4 bytes): A 32-bit, unsigned integer that specifies the size, in bytes, of this 
structure. This value MUST be greater than 0x00000010. All offsets specified in this structure 
MUST be less than this value, and all strings contained in this structure MUST fit within the 
extent defined by this size. 

DriveType (4 bytes): A 32-bit, unsigned integer that specifies the type of drive the link target 
is stored on. This value MUST be one of the following: 


Value 

Meaning 

DRIVE UNKNOWN 
0x00000000 

The drive type cannot be determined. 

DRIVE_NO_ROOT_DIR 

0x00000001 

The root path is invalid; for example, there is no volume mounted at the 
path. 

DRIVE_REMOVABLE 

0x00000002 

The drive has removable media, such as a floppy drive, thumb drive, or 
flash card reader. 

DRIVE FIXED 
0x00000003 

The drive has fixed media, such as a hard drive or flash drive. 

DRIVE REMOTE 
0x00000004 

The drive is a remote (network) drive. 

DRIVE_CDROM 

0x00000005 

The drive is a CD-ROM drive. 

DRIVE RAMDISK 
0x00000006 

The drive is a RAM disk. 


DriveSerialNumber (4 bytes): A 32-bit, unsigned integer that specifies the drive serial 
number of the volume the link target is stored on. 

VolumeLabelOffset (4 bytes): A 32-bit, unsigned integer that specifies the location of a string 
that contains the volume label of the drive that the link target is stored on. This value is an 
offset, in bytes, from the start of the VolumelD structure to a NULL-terminated string of 
characters, defined by the system default code page. The volume label string is located in the 
Data field of this structure. 

If the value of this field is 0x00000014, it MUST be ignored, and the value of the 
VolumeLabelOffsetUnicode field MUST be used to locate the volume label string. 

VolumeLabelOffsetUnicode (4 bytes): An optional, 32-bit, unsigned integer that specifies the 
location of a string that contains the volume label of the drive that the link target is stored on. 
This value is an offset, in bytes, from the start of the VolumelD structure to a NULL- 
terminated string of Unicode characters. The volume label string is located in the Data field of 
this structure. 

If the value of the VolumeLabelOffset field is not 0x00000014, this field MUST be ignored, 
and the value of the VolumeLabelOffset field MUST be used to locate the volume label 
string. 

Data (variable): A buffer of data that contains the volume label of the drive as a string defined 
by the system default code page or Unicode characters, as specified by preceding fields. 
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2.3.2 Common NetworkRelativeLink 


The CommonNetworkRelativeLink structure specifies information about the network location where a 
link target is stored, including the mapped drive letter and the UNC path prefix. For details on UNC 
paths, see rMS-DFSNMl section 2.2. 1.4. 


1 2 3 

01234567890123456789012345678901 


CommonNetworkRelativeLinkSize 


CommonNetworkRelativeLinkFlags 


NetNameOffset 


DeviceNameOffset 


NetworkProviderType 


NetNameOffsetUnicode (optional) 


DeviceNameOffsetUnicode (optional) 


NetName (variable) 


DeviceName (variable) 


NetNameUnicode (variable) 


DeviceNameUnicode (variable) 


CommonNetworkRelativeLinkSize (4 bytes): A 32-bit, unsigned integer that specifies the 
size, in bytes, of the CommonNetworkRelativeLink structure. This value MUST be greater than 
or equal to 0x00000014. All offsets specified in this structure MUST be less than this value, 
and all strings contained in this structure MUST fit within the extent defined by this size. 

CommonNetworkRelativeLinkFlags (4 bytes): Flags that specify the contents of the 
DeviceNameOffset and NetProviderType fields. 
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012 3 4 5 6 7 8 9 012 3 4 5 6 7 89 012 3 4 5 6 7 89 01 


A BO 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 


Where the bits are defined as: 


Value 

Description 

A 

ValidDevice 

If set, the DeviceNameOffset field contains an offset to the device name. 

If not set, the DeviceNameOffset field does not contain an offset to the device 
name, and its value MUST be zero. 

B 

ValidNetType 

If set, the NetProviderType field contains the network provider type. 

If not set, the NetProviderType field does not contain the network provider type, 
and its value MUST be zero. 


NetNameOffset (4 bytes): A 32-bit, unsigned integer that specifies the location of the 
NetName field. This value is an offset, in bytes, from the start of the 
CommonNetworkRelativeLink structure. 

DeviceNameOffset (4 bytes): A 32-bit, unsigned integer that specifies the location of the 
DeviceName field. If the ValidDevice flag is set, this value is an offset, in bytes, from the 
start of the CommonNetworkRelativeLink structure; otherwise, this value MUST be zero. 

NetworkProviderType C4 bytes): A 32-bit, unsigned integer that specifies the type of network 
provider. If the ValidNetType flag is set, this value MUST be one of the following; otherwise, 
this value MUST be ignored. 


Vendor name 


Value 


WNNC_NET_AVID 


WNNC_NET_DOCUSPACE 

WNNC_NET_MANGOSOFT 


WNNC_NET_SERNET 


WNNC_NET_RIVERFRONTl 


WN N C_N ET_RIVE RFRONT2 


WNNC_NET_DECORB 


WNNC_NET_PROTSTOR 


WN N C_N ET_FJ_RE DIR 


W N N C_N ET_D I STI N CT 


WNNC_NET_TWINS 


WN NC_N ET_RDR2SAM PLE 


WNNC_NET_CSC 


OxOOlAOOOO 


OxOOlBOOOO 

OxOOlCOOOO 


OxOOlDOOOO 


0X001E0000 


OxOOlFOOOO 


0x00200000 


0x00210000 


0x00220000 


0x00230000 


0x00240000 


0x00250000 


0x00260000 
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Vendor name 

Value 

WNNC_NET_3IN1 

0x00270000 

WNNC_NET_EXTENDNET 

0x00290000 

WNNC_NET_STAC 

0X002A0000 

WNNC_NET_FOXBAT 

0X002B0000 

WNNC_NET_YAHOO 

0X002C0000 

WNNC_NET_EXIFS 

0X002D0000 

WNNC_NET_DAV 

0X002E0000 

WNNC_NET_KNOWARE 

0X002F0000 

WNNC_NET_OBJECT_DIRE 

0x00300000 

WNNC_NET_MASFAX 

0x00310000 

WNNC_NET_HOB_NFS 

0x00320000 

WNNC_NET_SHIVA 

0x00330000 

WNNC_NET_IBMAL 

0x00340000 

WNNC_NET_LOCK 

0x00350000 

WNNC_NET_TERMSRV 

0x00360000 

W N N C_N ET_S RT 

0x00370000 

WNNC_NET_QUINCY 

0x00380000 

WNNC_NET_OPENAFS 

0x00390000 

WNNC_NET_AVID1 

0X003A0000 

WNNC_NET_DFS 

0X003B0000 

WNNC_I\IET_KWNP 

0X003C0000 

WNNC_NET_ZENWORKS 

0X003D0000 

WNNC_NET_DRIVEONWEB 

0X003E0000 

WNNC_NET_VMWARE 

0X003F0000 

W N N C_N ET_RS FX 

0x00400000 

WNNC_NET_MFILES 

0x00410000 

WNNC_NET_MS_NFS 

0x00420000 

WNNC_NET_GOOGLE 

0x00430000 


NetNameOffsetUnicode (4 bytes): An optional, 32-bit, unsigned integer that specifies the 
location of the NetNameUnicode field. This value is an offset, in bytes, from the start of the 
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CommonNetworkRelativeLink structure. This field MUST be present if the value of the 
NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be 
present. 

DeviceNameOffsetUnicode (4 bytes): An optional, 32-bit, unsigned integer that specifies the 
location of the DeviceNameUnicode field. This value is an offset, in bytes, from the start of 
the CommonNetworkRelativeLink structure. This field MUST be present if the value of the 
NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be 
present. 

NetName (variable): A NULL-terminated string, as defined by the system default code page, 
which specifies a server share path; for example, "\\server\share". 

DeviceName (variable): A NULL-terminated string, as defined by the system default code 
page, which specifies a device; for example, the drive letter "D:". 

NetNameUnicode (variable): An optional, NULL-terminated, Unicode string that is the 
Unicode version of the NetName string. This field MUST be present if the value of the 
NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be 
present. 

DeviceNameUnicode (variable): An optional, NULL-terminated, Unicode string that is the 
Unicode version of the DeviceName string. This field MUST be present if the value of the 
NetNameOffset field is greater than 0x00000014; otherwise, this field MUST NOT be 
present. 

2.4 StringData 

StringData refers to a set of structures that convey user interface and path identification 
information. The presence of these optional structures is controlled by LinkFlaqs (section 2.1.1) in 
the ShellLinkHeader (section 2.1) . 

The StringData structures conform to the following ABNF rules rRFC52341 . 


STRING_DATA = [NAME_STRING] [RELATIVE_PATH] [WORKING_DIR] 
[ COMMAND_L INE_ARGOMENT S ] [I C0N_L0CAT I ON ] 


NAME_STRING: An optional structure that specifies a description of the shortcut that is displayed 
to end users to identify the purpose of the shell link. This structure MUST be present if the 
HasName flag is set. 

RELATIVE_PATH : An optional structure that specifies the location of the link target relative to the 
file that contains the shell link. When specified, this string SHOULD be used when resolving the link. 
This structure MUST be present if the HasRelativePath flag is set. 

WORKING_DIR: An optional structure that specifies the file system path of the working directory 
to be used when activating the link target. This structure MUST be present if the HasWorkingDir 
flag is set. 

COMMAND_LINE_ARGUMENTS: An optional structure that stores the command-line arguments 
that should be specified when activating the link target. This structure MUST be present if the 

HasArguments flag is set. 


26/51 

[MS-SHLLINK] - V20131025 
Shell Link (.LNK) Binary File Format 

Copyright © 2013 Microsoft Corporation. 

Release: Friday, October 25, 2013 


ICON_LOCATION : An optional structure that specifies the location of the icon to be used when 
displaying a shell link item in an icon view. This structure MUST be present if the HasIconLocation 
flag is set. 

All StringData structures have the following structure. 
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CountCharacters (2 bytes): A 16-bit, unsigned integer that specifies either the number of 
characters, defined by the system default code page, or the number of Unicode characters 
found in the String field. A value of zero specifies an empty string. 

String (variable): An optional set of characters, defined by the system default code page, or a 
Unicode string with a length specified by the CountCharacters field. This string MUST NOT be 
NULL-terminated. 

2.5 ExtraData 

ExtraData refers to a set of structures that convey additional information about a link target. These 
optional structures can be present in an extra data section that is appended to the basic Shell Link 
Binary File Format. 

The ExtraData structures conform to the following ABNF rules rRFC52341 : 


EXTRA_DATA 


= *EXTRA_DATA_BLQCK TERMINAL_BLOCK 


EXTRA_DATA_BLOCK 


CONSOLE_PROPS / CONSOLE_FE_PROPS / DARWIN_PROPS / 
ENVI RONMENT_PRO P S / ICON_ENVIRONMENT_PROPS / 
KNOWN_FOLDER_PROPS / PROPERTY_STORE_PROPS / 
SHIM_PROPS / SPECIAL_FOLDER_PROPS / 

TRACKER_PROPS / VISTA_AND_ABOVE_IDLIST_PROPS 


EXTRA_DATA: A structure consisting of zero or more property data blocks followed by a terminal 
block. 

EXTRA_D AT A_BLOC K : A structure consisting of any one of the following property data blocks. 

■ CONSOLE_PROPS: A ConsoleDataBlock structure (section 2.5.1) . 

■ CONSOLE_FE_PROPS: A ConsoleFEData Block structure (section 2.5.2) . 

■ DARWIN_PROPS : A DarwinDataBlock structure (section 2.5.3 ). 

■ ENVIRON MENT_PROPS: An EnvironmentVariableDataBlock structure (section 2.5.4 ). 

■ ICON_ENVI RONMENT_PROPS: An IconEnvironmentData Block structure (section 2.5.5 ). 

■ KNOWN_FOLDER_PROPS: A KnownFolderDataBlock structure (section 2.5.6) . 
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■ PROPERTY_STORE_PROPS: A PropertvStoreDataBlock structure (section 2.5.71 . 

■ SHIM_PROPS: A ShimData Block structure (section 2.5.8 1. 

■ SPECIAL_FOLDER_PROPS: A SpecialFolderPataBlock structure (section 2.5.91 . 

■ TRACKER_PROPS : A TrackerPataBlock structure (section 2.5.10) . 

■ VISTA_AND_ABOVE_IDLIST_PROPS: A VistaAndAbovelPListPata Block structure (section 
2.5.11 1. 

TERMINAL_BLOCK A structure that indicates the end of the extra data section. 

The general structure of an extra data section is shown in the following diagram. 

l 2 3 

01234567890123456789012345678901 

Extra Data Block (variable) 


TerminalBlock 

ExtraDataBlock (variable): An optional array of bytes that contains zero or more property 
data blocks listed in the EXTRA_DATA_BLOCK syntax rule. 

TerminalBlock (4 bytes): A 32-bit, unsigned integer that indicates the end of the extra data 
section. This value MUST be less than 0x00000004. 

2.5.1 ConsoleDataBlock 

The ConsolePataBlock structure specifies the display settings to use when a link target specifies an 
application that is run in a console window. < 2 >_ 
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ScreenBufferSizeX 

ScreenBufferSizeV 

WindowSizeX 
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WindowOriginX 

WindowOriginY 

Unusedl 
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Unused2 

FontSize 

FontFamily 

FontWeight 

Face Name 








(Face Name cont'd for 8 rows) 

CursorSize 

FullScreen 

QuickEdit 

InsertMode 

AutoPosition 

HistoryBufferSize 

NumberOfHistory Buffers 

HistoryNoDup 

ColorTable 
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(ColorTable cont'd for 8 rows) 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the ConsoleDataBlock 
structure. This value MUST be OxOOOOOOCC. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
ConsoleDataBlock extra data section. This value MUST be 0xA0000002. 

FillAttributes (2 bytes): A 16-bit, unsigned integer that specifies the fill attributes that control 
the foreground and background text colors in the console window. The following bit definitions 
can be combined to specify 16 different values each for the foreground and background 
colors: 


Value 

Meaning 

FOREGROUND BLUE 

0x0001 

The foreground text color contains blue. 

FOREGROUND_GREEN 

0x0002 

The foreground text color contains green. 

FOREGROUND_RED 

0x0004 

The foreground text color contains red. 

FOREGROUND INTENSITY 

0x0008 

The foreground text color is intensified. 

BACKGROUND_BLUE 

0x0010 

The background text color contains blue. 

BACKGROUND_GREEN 

0x0020 

The background text color contains green. 

BACKGROUND RED 

0x0040 

The background text color contains red. 

BACKGROUND INTENSITY 

0x0080 

The background text color is intensified. 
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PopupFillAttributes (2 bytes): A 16-bit, unsigned integer that specifies the fill attributes that 
control the foreground and background text color in the console window popup. The values are 
the same as for the FillAttributes field. 

ScreenBufferSizeX (2 bytes): A 16-bit, signed integer that specifies the horizontal size (X 
axis), in characters, of the console window buffer. 

ScreenBufferSizeY (2 bytes): A 16-bit, signed integer that specifies the vertical size (Y axis), 
in characters, of the console window buffer. 

WindowSizeX (2 bytes): A 16-bit, signed integer that specifies the horizontal size (X axis), in 
characters, of the console window. 

WindowSizeY (2 bytes): A 16-bit, signed integer that specifies the vertical size (Y axis), in 
characters, of the console window. 

WindowOriginX (2 bytes): A 16-bit, signed integer that specifies the horizontal coordinate (X 
axis), in pixels, of the console window origin. 

WindowOriginY (2 bytes): A 16-bit, signed integer that specifies the vertical coordinate (Y 
axis), in pixels, of the console window origin. 

Unusedl (4 bytes): A value that is undefined and MUST be ignored. 

Unused2 (4 bytes): A value that is undefined and MUST be ignored. 

FontSize (4 bytes): A 32-bit, unsigned integer that specifies the size, in pixels, of the font 
used in the console window. 

FontFamily (4 bytes): A 32-bit, unsigned integer that specifies the family of the font used in 
the console window. This value MUST be one of the following: 


Value 

Meaning 

FF_DONTCARE 

0x0000 

The font family is unknown. 

FF_ROMAN 

0x0010 

The font is variable-width with serifs; for example, "Times New Roman". 

FF SWISS 

0x0020 

The font is variable-width without serifs; for example, "Arial". 

FF_MODERN 

0x0030 

The font is fixed-width, with or without serifs; for example, "Courier New". 

FF SCRIPT 

0x0040 

The font is designed to look like handwriting; for example, "Cursive". 

FF DECORATIVE 
0x0050 

The font is a novelty font; for example, "Old English". 


FontWeight (4 bytes): A 16-bit, unsigned integer that specifies the stroke weight of the font 
used in the console window. 
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Value 

Meaning 

700 < value 

A bold font. 

value < 700 

A regular-weight font. 


Face Name (64 bytes): A 32-character Unicode string that specifies the face name of the font 
used in the console window. 

CursorSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the cursor, in pixels, 
used in the console window. 


Value 

Meaning 

value <25 

A small cursor. 

26 - 50 

A medium cursor. 

51 - 100 

A large cursor. 


FullScreen (4 bytes): A 32-bit, unsigned integer that specifies whether to open the console 
window in full-screen mode. 


Value 

Meaning 

0x00000000 

Full-screen mode is off. 

0x00000000 < value 

Full-screen mode is on. 


QuickEdit (4 bytes): A 32-bit, unsigned integer that specifies whether to open the console 
window in QuikEdit mode. In QuickEdit mode, the mouse can be used to cut, copy, and paste 
text in the console window. 


Value 

Meaning 

0x00000000 

QuikEdit mode is off. 

0x00000000 < value 

QuikEdit mode is on. 


InsertMode (4 bytes): A 32-bit, unsigned integer that specifies insert mode in the console 
window. 


Value 

Meaning 

0x00000000 

Insert mode is disabled. 

0x00000000 < value 

Insert mode is enabled. 


AutoPosition (4 bytes): A 32-bit, unsigned integer that specifies auto-position mode of the 
console window. 
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Value 

Meaning 

0x00000000 

The values of the WindowOriginX and WindowOriginY fields are used to 
position the console window. 

0x00000000 < 
value 

The console window is positioned automatically. 


HistoryBufferSize (4 bytes): A 32-bit, unsigned integer that specifies the size, in characters, 
of the buffer that is used to store a history of user input into the console window. 

NumberOfHistoryBuffers (4 bytes): A 32-bit, unsigned integer that specifies the number of 
history buffers to use. 

HistoryNoDup (4 bytes): A 32-bit, unsigned integer that specifies whether to remove 
duplicates in the history buffer. 


Value 

Meaning 

0x00000000 

Duplicates are not allowed. 

0x00000000 < value 

Duplicates are allowed. 


ColorTable (64 bytes): A table of 16 32-bit, unsigned integers specifying the RGB colors that 
are used for text in the console window. The values of the fill attribute fields FillAttributes 
and PopupFillAttributes are used as indexes into this table to specify the final foreground 
and background color for a character. 

2.5.2 ConsoleFEDataBlock 

The ConsoleFEDataBlock structure specifies the code page to use for displaying text when a link 
target specifies an application that is run in a console window. <3> 


l 2 3 

01234567890123456789012345678901 


BlockSize 


BlockSignature 


CodePage 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 
ConsoleFEDataBlock structure. This value MUST be OxOOOOOOOC. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
ConsoleFEDataBlock extra data section. This value MUST be 0xA0000004. 

CodePage (4 bytes): A 32-bit, unsigned integer that specifies a code page language code 
identifier. For details concerning the structure and meaning of language code identifiers, see 
rMS-LCIDl . For additional background information, see rMSCFIARSETl and fMSDN- 
CODEPAGE1 . 
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2.5.3 DarwinDataBlock 


The DarwinDataBlock structure specifies an application identifier that can be used instead of a link 
target IDList to install an application when a shell link is activated. 


012 3 4 5 6 7 8 9 012 3 4 5 6 7 8 9 012 3 4 5 6 7 8 9 01 


BlockSize 


BlockSignature 


DarwinDataAnsi 


(DarwinDataAnsi cont'd for 57 rows) 


DarwinDataUnicode (optional) 


(DarwinDatallnicode (optional) cont'd for 122 rows) 
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BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the DarwinDataBlock 
structure. This value MUST be 0x00000314. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
DarwinDataBlock extra data section. This value MUST be 0xA0000006. 

DarwinDataAnsi (260 bytes): A NULL-terminated string, defined by the system default code 
page, which specifies an application identifier. This field SHOULD be ignored. 

DarwinDataUnicode (520 bytes): An optional, NULL-terminated, Unicode string that specifies 
an application identifier. <4> 

2.5.4 EnvironmentVariableDataBlock 

The EnvironmentVariableDataBlock structure specifies a path to environment variable information 
when the link target refers to a location that has a corresponding environment variable. 


l 2 3 

01234567890123456789012345678901 


BlockSize 


BlockSignature 


TargetAnsi 


(TargetAnsi cont'd for 57 rows) 


TargetUnicode 
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(TargetUnicode cont'd for 122 rows) 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 
EnvironmentVariableDataBlock structure. This value MUST be 0x00000314. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
EnvironmentVariableDataBlock extra data section. This value MUST be OxAOOOOOOl. 

TargetAnsi (260 bytes): A NULL-terminated string, defined by the system default code page, 
which specifies a path to environment variable information. 

TargetUnicode (520 bytes): An optional, NULL-terminated, Unicode string that specifies a 
path to environment variable information. 

2.5.5 IconEnvironmentDataBlock 

The IconEnvironmentDataBlock structure specifies the path to an icon. The path is encoded using 
environment variables, which makes it possible to find the icon across machines where the locations 
vary but are expressed using environment variables. 
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BlockSize 


BlockSignature 


TargetAnsi 
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(TargetAnsi cont'd for 57 rows) 
TargetUnicode 


| (TargetUnicode cont'd for 122 rows) 

BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 
IconEnvironmentDataBlock structure. This value MUST be 0x00000314. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
IconEnvironmentDataBlock extra data section. This value MUST be 0xA0000007. 

TargetAnsi (260 bytes): A NULL-terminated string, defined by the system default code page, 
which specifies a path that is constructed with environment variables. 

TargetUnicode (520 bytes): An optional, NULL-terminated, Unicode string that specifies a 
path that is constructed with environment variables. 

2.5.6 KnownFolderDataBlock 

The KnownFolderDataBlock structure specifies the location of a known folder. This data can be used 
when a link target is a known folder to keep track of the folder so that the link target IDList can be 
translated when the link is loaded. 



BlockSize 


BlockSignature 

KnownFolderlD 
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Offset 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 
KnownFolderDataBlock structure. This value MUST be OxOOOOOOlC. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
KnownFolderDataBlock extra data section. This value MUST be OxAOOOOOOB. 

KnownFolderlD (16 bytes): A value in GUID packet representation ( rMS-DTYPl section 
2. 3. 2. 2) that specifies the folder GUID ID. 

Offset (4 bytes): A 32-bit, unsigned integer that specifies the location of the ItemID of the first 
child segment of the IDList specified by KnownFolderlD. This value is the offset, in bytes, 
into the link target IDList. 

2.5.7 PropertyStoreDataBlock 

A PropertyStoreDataBlock structure specifies a set of properties that can be used by applications to 
store extra data in the shell link. 


l 2 3 
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BlockSize 


BlockSignature 


PropertyStore (variable) 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 

PropertyStoreDataBlock structure. This value MUST be greater than or equal to OxOOOOOOOC. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
PropertyStoreDataBlock extra data section. This value MUST be 0xA0000009. 

PropertyStore (variable): A serialized property storage structure (TMS-PROPSTORE1 section 

2 . 2 ). 

2.5.8 ShimDataBlock 

The ShimDataBlock structure specifies the name of a shim that can be applied when activating a 
link target. 
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1 2 3 

01234567890123456789012345678901 


BlockSize 


BlockSignature 


LayerName (variable) 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the ShimDataBlock 
structure. This value MUST be greater than or equal to 0x00000088. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
ShimDataBlock extra data section. This value MUST be 0xA0000008. 

LayerName (variable): A Unicode string that specifies the name of a shim layer to apply to a 
link target when it is being activated. 


2.5.9 SpecialFolderDataBlock 

The SpecialFolderDataBlock structure specifies the location of a special folder. This data can be used 
when a link target is a special folder to keep track of the folder, so that the link target IDList can be 
translated when the link is loaded. 


l 2 3 
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BlockSize 


BlockSignature 


SpecialFolderlD 


Offset 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 
SpecialFolderDataBlock structure. This value MUST be 0x00000010. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
SpecialFolderDataBlock extra data section. This value MUST be 0xA0000005. 

SpecialFolderlD (4 bytes): A 32-bit, unsigned integer that specifies the folder integer ID. 

Offset (4 bytes): A 32-bit, unsigned integer that specifies the location of the ItemID of the first 
child segment of the IDList specified by SpecialFolderlD. This value is the offset, in bytes, 
into the link target IDList. 
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2.5.10 TrackerDataBlock 


The TrackerDataBlock structure specifies data that can be used to resolve a link target if it is not 
found in its original location when the link is resolved. This data is passed to the Link Tracking 
service rMS-DLTWl to find the link target. 


1 2 3 
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BlockSize 


BlockSignature 


Length 


Version 


MachinelD (variable) 


Droid 


DroidBirth 
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BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the TrackerDataBlock 
structure. This value MUST be 0x00000060. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
TrackerDataBlock extra data section. This value MUST be 0xA0000003. 

Length (4 bytes): A 32-bit, unsigned integer. This value MUST be greater than or equal to 
0x0000058. 

Version (4 bytes): A 32-bit, unsigned integer. This value MUST be 0x00000000. 

MachinelD (variable): A character string, as defined by the system default code page, which 
specifies the NetBIOS name of the machine where the link target was last known to reside. 

Droid (32 bytes): Two values in GUID packet representation ( rMS-DTYPl section 2. 3. 2. 2) that 
are used to find the link target with the Link Tracking service, as specified in [MS-DLTW]. 

DroidBirth (32 bytes): Two values in GUID packet representation that are used to find the link 
target with the Link Tracking service 

2.5.11 VistaAndAbovelDListDataBlock 

The VistaAndAbovelDListDataBlock structure specifies an alternate IDList that can be used instead 
of the LinkTarqetIDList structure (section 2.2 ) on platforms that support it. <5> 


1 2 3 
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BlockSize 


BlockSignature 


IDList (variable) 


BlockSize (4 bytes): A 32-bit, unsigned integer that specifies the size of the 

VistaAndAbovelDListDataBlock structure. This value MUST be greater than or equal to 
OxOOOOOOOA. 

BlockSignature (4 bytes): A 32-bit, unsigned integer that specifies the signature of the 
VistaAndAbovelDListDataBlock extra data section. This value MUST be OxAOOOOOOC. 

IDList (variable): An IDList structure (section 2.2.1) . 
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3 Structure Examples 

3.1 Shortcut to a File 

This section presents a sample of the Shell Link Binary File Format, consisting of a shortcut to a file 
with the path "C:\test\a.txt". 


The following is the hexadecimal representation of the contents of the shell link. 
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HeaderSize: (4 bytes, offset 0x0000), 0x0000004C as required. 

LinkCLSID: (16 bytes, offset 0x0004), 00021401-0000-0000-C000-000000000046. 

LinkFlags: (4 bytes, offset 0x0014), 0x0008009B means the following LinkFlaqs (section 2.1.1) are 
set: 

■ HasLinkTargetIDList 

■ HasLinklnfo 

■ HasRelativePath 

■ HasWorkingDir 

■ Isllnicode 

■ EnableTargetMetadata 

FileAttributes: (4 bytes, offset 0x0018), 0x00000020, means the following FileAttributesFlaqs 
(section 2.1.2) are set: 

■ FILE_ATTRIBUTE_ARCHIVE 

CreationTime: (8 bytes, offset OxOOlC) FILETIME 9/12/08, 8:27:17PM. 

AccessTime: (8 bytes, offset 0x0024) FILETIME 9/12/08, 8:27:17PM. 

WriteTime: (8 bytes, offset 0x002C) FILETIME 9/12/08, 8:27:17PM. 

FileSize: (4 bytes, offset 0x0034), 0x00000000. 

Iconlndex: (4 bytes, offset 0x0038), 0x00000000. 

ShowCommand: (4 bytes, offset 0x003C), SW_SHOWI\IORMAL(l). 

Hotkey: (2 bytes, offset 0x0040), 0x0000. 

Reserved: (2 bytes, offset 0x0042), 0x0000. 

Reserved2: (4 bytes, offset 0x0044), 0 X00000000. 

Reserved3: (4 bytes, offset 0x0048), 0 xOOOOOOOO. 

Because HasLinkTargetIDList is set, a LinkTarqetIDList structure (section 2.2) follows: 

■ IDListSize: (2 bytes, offset 0x004C), OxOOBD, the size of IDList. 
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IDList: (189 bytes, offset 0x004E) an IDList structure (section 2.2.1) follows: 


■ ItemIDList: (187 bytes, offset 0x004E), ItemID structures (section 2.2.2) follow: 

■ ItemIDSize: (2 bytes, offset 0x004E), 0x0014 

■ Data: (12 bytes, offset 0x0050), <18 bytes of data> [computer] 

■ ItemIDSize: (2 bytes, offset 0x0062), 0x0019 

■ Data: (23 bytes, offset 0x0064), <23 bytes of data> [c:] 

■ ItemIDSize: (2 bytes, offset 0x007B), 0x0046 

■ Data: (68 bytes, offset 0x007D), <68 bytes of data> [test] 

■ ItemIDSize: (2 bytes, offset OxOOCl), 0x0048 

■ Data: (68 bytes, offset 0x00C3), <70 bytes of data> [a.txt] 

■ TerminallD: (2 bytes, offset 0x0109), 0x0000 indicates the end of the IDList. 

Because HasLinklnfo is set, a Linklnfo structure (section 2.3) follows: 

■ LinklnfoSize: (4 bytes, offset OxOlOB), 0x0000003C 

■ LinklnfoHeaderSize: (4 bytes, offset OxOlOF), OxOOOOOOlC as specified in the Linklnfo 
structure definition. 

■ LinklnfoFlags: (4 bytes, offset 0x0113), 0x00000001 VolumelDAndLocalBasePath is set. 

■ VolumelDOffset: (4 bytes, offset 0x0117), OxOOOOOOlC, references offset 0x0127. 

■ Local BasePathOffset: (4 bytes, offset OxOllB), 0x0000002D, references the character string 
"C:\test\a.txt". 

■ CommonNetworkRelativeLinkOffset: (4 bytes, offset 0x01 IF), 0x00000000 indicates 

CommonNetworkRelativeLink is not present. 

■ CommonPathSuffixOffset: (4 bytes, offset 0x0123), 0x0000003B, references offset 
0x00000146, the character string "" (empty string). 

■ VolumelD: (17 bytes, offset 0x0127), because VolumelDAndLocalBasePath is set, a 
VolumelD structure (section 2.3.1) follows: 

■ VolumelDSize: (4 bytes, offset 0x0127), 0x00000011 indicates the size of the VolumelD 
structure. 

■ DriveType: (4 bytes, offset 0x012B), DRIVE_FIXED(3). 

■ DriveSerialNumber: (4 bytes, offset 0x012F), 0x307A8A81. 

■ VolumeLabelOffset: (4 bytes, offset 0x0133), 0x00000010, indicates that Volume Label 
Offset Unicode is not specified and references offset 0x0137 where the Volume Label is stored. 

■ Data: (1 byte, offset 0x0137), "" an empty character string. 

■ LocalBasePath: (14 bytes, offset 0x0138), because VolumelDAndLocalBasePath is set, the 
character string "c:\test\a.txt" is present. 
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■ CommonPathSuffix: (1 byte, offset 0x0146), "" an empty character string. 

Because HasRelativePath is set, the RELATIVE_PATH StrinqData structure (section 2.4) follows: 

■ CountCharacters: (2 bytes, offset 0x0147), 0x0007 Unicode characters. 

■ String (14 bytes, offset 0x0149), the Unicode string: ".\a.txt". 

Because HasWorkingDir is set, the WORKING_DIR StringData structure (section 2.4 ) follows: 

■ CountCharacters: (2 bytes, offset 0x0157), 0x0007 Unicode characters. 

■ String (14 bytes, offset 0x0159), the Unicode string: "c:\test". 

Extra data section: (100 bytes, offset 0x0167), an ExtraData structure (section 2.5) follows: 

■ Extra Data Block (96 bytes, offset 0x0167), the TrackerPataBlock structure (section 2.5.10 ) 
follows: 

■ BlockSize: (4 bytes, offset 0x0167), 0x00000060 

■ BlockSignature: (4 bytes, offset 0x016B), 0xA000003, which identifies the TrackerPataBlock 
structure (section 2.5.10 ). 

■ Length: (4 bytes, offset 0x016F), 0x00000058, the required minimum size of this extra data 
block. 

■ Version: (4 bytes, offset 0x0173), 0x00000000, the required version. 

■ MachinelD: (16 bytes, offset 0x0177), the character string "chris-xps", with zero fill. 

■ Droid: (32 bytes, offset 0x0187), 2 GUID values. 

■ DroidBirth: (32 bytes, offset 0x01A7), 2 GUID values. 

■ TerminalBlock: (4 bytes, offset 0x01C7), 0x00000000 indicates the end of the extra data 
section. 
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4 Security 

None. 
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5 Appendix A: Product Behavior 

The information in this specification is applicable to the following Microsoft products or supplemental 
software. References to product versions include released service packs: 

■ Windows NT 3.1 operating system 

■ Windows NT 3.5 operating system 

■ Windows NT 3.51 operating system 

■ Windows NT 4.0 operating system 

■ Windows 2000 operating system 

■ Windows XP operating system 

■ Windows Server 2003 operating system 

■ Windows Vista operating system 

■ Windows Server 2008 operating system 

■ Windows 7 operating system 

■ Windows Server 2008 R2 operating system 

■ Windows 8 operating system 

■ Windows Server 2012 operating system 

■ Windows 8.1 operating system 

■ Windows Server 2012 R2 operating system 

Exceptions, if any, are noted below. If a service pack or Quick Fix Engineering (QFE) number 
appears with the product version, behavior changed in that service pack or QFE. The new behavior 
also applies to subsequent service packs of the product unless otherwise specified. If a product 
edition appears with the product version, behavior is different in that product edition. 

Unless otherwise specified, any statement of optional behavior in this specification that is prescribed 
using the terms SFIOULD or SFIOULD NOT implies product behavior in accordance with the SFIOULD 
or SFIOULD NOT prescription. Unless otherwise specified, the term MAY implies that the product 
does not follow the prescription. 

<1> Section 2.3: In Windows, Unicode characters are stored in this structure if the data cannot be 
represented as ANSI characters due to truncation of the values. In this case, the value of the 
LinklnfoHeaderSize field is greater than or equal to 36. 

<2> Section 2.5.1: In Windows environments, this is commonly known as a "command prompt" 
window. 

<3> Section 2.5.2: In Windows environments, this is commonly known as a "command prompt" 
window. 

<4> Section 2.5.3: In Windows, this is a Windows Installer (MSI) application descriptor. For more 
information, see rMSDN-MSISHORTCUTSl . 
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<5> Section 2.5.11: T he VistaAndAbovelDListDataBlock structure is supported on Windows Vista, 
Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, 
Windows 8.1, and Windows Server 2012 R2 only. 
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6 Change Tracking 

This section identifies changes that were made to the [MS-SHLLINK] protocol document between the 
August 2013 and November 2013 releases. Changes are classified as New, Major, Minor, Editorial, 
or No change. 

The revision class New means that a new document is being released. 

The revision class Major means that the technical content in the document was significantly revised. 
Major changes affect protocol interoperability or implementation. Examples of major changes are: 

■ A document revision that incorporates changes to interoperability requirements or functionality. 

■ An extensive rewrite, addition, or deletion of major portions of content. 

■ The removal of a document from the documentation set. 

■ Changes made for template compliance. 

The revision class Minor means that the meaning of the technical content was clarified. Minor 
changes do not affect protocol interoperability or implementation. Examples of minor changes are 
updates to clarify ambiguity at the sentence, paragraph, or table level. 

The revision class Editorial means that the language and formatting in the technical content was 
changed. Editorial changes apply to grammatical, formatting, and style issues. 

The revision class No change means that no new technical or language changes were introduced. 
The technical content of the document is identical to the last released version, but minor editorial 
and formatting changes, as well as updates to the header and footer information, and to the revision 
summary, may have been made. 

Major and minor changes can be described further using the following change types: 

■ New content added. 

■ Content updated. 

■ Content removed. 

■ New product behavior note added. 

■ Product behavior note updated. 

■ Product behavior note removed. 

■ New protocol syntax added. 

■ Protocol syntax updated. 

■ Protocol syntax removed. 

■ New content added due to protocol revision. 

■ Content updated due to protocol revision. 

■ Content removed due to protocol revision. 

■ New protocol syntax added due to protocol revision. 
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■ Protocol syntax updated due to protocol revision. 

■ Protocol syntax removed due to protocol revision. 

■ New content added for template compliance. 

■ Content updated for template compliance. 

■ Content removed for template compliance. 

■ Obsolete document removed. 

Editorial changes are always classified with the change type Editorially updated. 

Some important terms used in the change type descriptions are defined as follows: 

■ Protocol syntax refers to data elements (such as packets, structures, enumerations, and 
methods) as well as interfaces. 

■ Protocol revision refers to changes made to a protocol that affect the bits that are sent over 
the wire. 

The changes made to this document are listed in the following table. For more information, please 
contact protocol@microsoft.com . 


Section 

Tracking number (if applicable) 
and description 

Major 
change 
(Y or N) 

Change type 

13 

Linklnfo 

67111 

Clarified the description of the LinklnfoHeaderSize field. 

Y 

Content updated. 
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